Home › Guides › Linux
Linux · How-to

How to Harden SSH on Ubuntu in Three Moves

Lock down remote access so passwords can't be brute-forced. Three moves: switch to key auth, tighten the config, add fail2ban.

You'll need: An Ubuntu machine you access over SSH, and a second session open as a safety net.

Steps

  1. Generate an Ed25519 key on your local machine: ssh-keygen -t ed25519.
  2. Copy the public key to the server: ssh-copy-id you@your-server.
  3. Log in WITH the key to confirm it works before touching password auth.
  4. Edit /etc/ssh/sshd_config: set PasswordAuthentication no, PermitRootLogin no, and PubkeyAuthentication yes.
  5. Restart SSH: sudo systemctl restart sshd — keeping your current key-based session open.
  6. Install fail2ban (sudo apt install fail2ban) and confirm the sshd jail is enabled.
  7. Open a brand-new SSH session to verify key login still works before closing the old one.
Watch outNever disable password auth before confirming your key login works — you'll lock yourself out. Keep the original session open until the new one succeeds.

Go deeper: Build a Hardened Linux Workstation

Every command, the exact sshd_config lines, and the fail2ban jail setup are in the Linux guide.

Get the guide